[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHX7iaF-vU46920RUCiA3SJ4Fqc4iX68JCu5ePSTF6Js":3},{"article":4,"iocs":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"da35389d-e284-4818-9536-286db9ad9c11","Check Point, Kaspersky, Tanium Patch Product Vulnerabilities","check-point-kaspersky-tanium-patch-product-vulnerabilities-d40645","Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges. The post Check Point, Kaspersky, Tanium Patch Product Vulnerabilities appeared first on SecurityWeek.","Cybersecurity vendors Check Point, Kaspersky, and Tanium have released patches for severe vulnerabilities affecting their products. Check Point's Security Management and Log Servers have a critical RCE flaw (CVE-2026-91843), though no in-the-wild exploitation is reported. Tanium addressed five high- and medium-severity flaws in Tanium Asset and Threat Response, including SQL injection and SSRF. Kaspersky patched a Redis vulnerability in Kaspersky Security 10 for Linux Mail Server that could lead to malfunction or code execution.","Check Point, Kaspersky, and Tanium patch critical vulnerabilities in their products.","Cybersecurity firms Check Point, Kaspersky, and Tanium have each patched severe vulnerabilities in their products, including ones that can be exploited for remote code execution. Check Point has informed customers about a critical vulnerability affecting Security Management and Log Server products. The flaw, CVE-2026-91843, can be exploited by an unauthenticated attacker “to remotely execute arbitrary code with root privileges through the login process.” Threat actors appear to have set their sights on vulnerabilities in Check Point products in recent months, including zero-days. However, for CVE-2026-91843 the vendor noted that there is no evidence of in-the-wild exploitation. Nevertheless, it has shared some potential indicators of compromise (IoCs). Check Point has advised customers who don’t have automatic updates enabled to immediately patch their installations. Tanium published five new advisories this week to inform customers about high- and medium-severity vulnerabilities. Advertisement. Scroll to continue reading. In Tanium Asset, the company fixed two high-severity SQL injection vulnerabilities that authenticated attackers can exploit to gain read and write access to restricted data, or tamper with SQL queries executed by the service. A vulnerability that can be leveraged for SQL query tampering has also been fixed in Threat Response. Threat Response has also received patches for two medium-severity vulnerabilities: a server-side request forgery allowing access to restricted data, and an improper access control issue that can be exploited to create or modify alerts. Kaspersky published a new advisory on September 17 to inform users that Kaspersky Security 10 for Linux Mail Server is affected by a Redis vulnerability discovered in 2023. “The vulnerability could potentially cause product malfunction or allow an attacker to execute code when processing files of a certain format,” Kaspersky explained. Related: Check Point Patches Critical VPN Vulnerabilities Related: Trend Micro, Tanium, ESET and Tenable Patch Severe Product Vulnerabilities Related: Ivanti Patches Critical Flaws Across Enterprise Security Products Related: Palo Alto Networks Patches 13 Vulnerabilities Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing RefusalsPixel Modem Zero-Day Exploited in Targeted AttacksUS, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance MalwareEnterprises Warned of Attacks Exploiting WSO2 VulnerabilityTexas Utility CenterPoint Energy Confirms Breach After Hacker Leaks DataOpenAI Investigates Report Linking AI Agents to RubyGems AttackMicrosoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety ConstraintsRoot RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation Latest News MIND Secures $72 Million for AI-Powered DLPCyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board VesselsOpenAI Says Its Models Searched GitHub for Leaked API Keys During TrainingCISA Retires Weekly Vulnerability Bulletin in Risk-Based PivotRevolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M RansomComp AI Raises $34 Million for AI-Native Compliance and SecurityISC Patches 14 Vulnerabilities in BIND 9 Security UpdateRansomware Attacks on Manufacturers Surge as Supply Chain Risk Grows Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the Moveincident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.GDIT has appointed retired Maj. Gen. Ryan Heritage as Vice President, Full-Spectrum Cyber.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, \"data\" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fcheck-point-kaspersky-tanium-patch-product-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F05\u002Ffirewall.jpeg","2026-09-18T07:14:04+00:00","2026-09-18T08:00:24.306187+00:00",8,[18,21,23,25,28,30],{"name":19,"type":20},"Check Point","vendor",{"name":22,"type":20},"Kaspersky",{"name":24,"type":20},"Tanium",{"name":26,"type":27},"Security Management and Log Server","product",{"name":29,"type":27},"Tanium Asset",{"name":31,"type":27},"Threat Response","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"cve","CVE-2026-91843","Critical RCE vulnerability in Check Point Security Management and Log Servers"]